openvswitch requires write access to /etc which is not sensible. /etc may be on a ro mounted root (in my case a ro mounted ssd). If lock files and suchlike stuff is required /etc is the wrong place, /var should be used instead. Examples: /etc/openvswitch/.conf.db.tmp.~lock~ /etc/openvswitch/.conf.db.~lock~
--with-pkidir=/etc/openvswitch/pki
/etc/openvswitch is the default location for the configuration database and (I assume) the lock files need to reside on the same filesystem as conf.db. Can you run ovsdb-server with an alternate database path to suit your environment with a r/o /etc? It doesn't seem appropriate to move configuration data to /var by default.
I guess we should move it to /var/db/openvswitch since upstream describes the configuration files as database anyway. Any objections?
Fixed in version bump to 1.9.0 by moving the configuration database to /var/lib/openvswitch